Overcoming the hurdle of legal expertise: A reusable model for smartwatch privacy policies

TL;DR

This paper presents a reusable conceptual model for smartwatch privacy policies, aiding developers in understanding and visualizing privacy statements across different manufacturers to enhance data sovereignty and user trust.

Contribution

It introduces a novel, reusable privacy policy model for smartwatches, validated with legal experts, and demonstrates its application in a model-driven software engineering platform.

Findings

Analyzed privacy policies of various smartwatch manufacturers.

Validated the model with legal experts for correctness.

Developed a platform for visualizing privacy policies.

Abstract

Regulations for privacy protection aim to protect individuals from the unauthorized storage, processing, and transfer of their personal data but oftentimes fail in providing helpful support for understanding these regulations. To better communicate privacy policies for smartwatches, we need an in-depth understanding of their concepts and provide better ways to enable developers to integrate them when engineering systems. Up to now, no conceptual model exists covering privacy statements from different smartwatch manufacturers that is reusable for developers. This paper introduces such a conceptual model for privacy policies of smartwatches and shows its use in a model-driven software engineering approach to create a platform for data visualization of wearable privacy policies from different smartwatch manufacturers. We have analyzed the privacy policies of various manufacturers and extracted the relevant concepts. Moreover, we have checked the model with lawyers for its correctness, instantiated it with concrete data, and used it in a model-driven software engineering approach to create a platform for data visualization. This reusable privacy policy model can enable developers to easily represent privacy policies in their systems. This provides a foundation for more structured and understandable privacy policies which, in the long run, can increase the data sovereignty of application users.